From 3cc956cd996f343fbb3b12c02acb8de06be85ad7 Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Mon, 8 Aug 2022 01:47:33 -0400 Subject: [PATCH 1/8] Add AWS Credential Access detections --- .../aws_credential_access_failed_login.yml | 62 +++++++++++++++++++ ...s_credential_access_rds_password_reset.yml | 56 +++++++++++++++++ ...ws_credential_access_failed_login.test.yml | 13 ++++ ...dential_access_rds_password_reset.test.yml | 13 ++++ 4 files changed, 144 insertions(+) create mode 100644 detections/cloud/aws_credential_access_failed_login.yml create mode 100644 detections/cloud/aws_credential_access_rds_password_reset.yml create mode 100644 tests/cloud/aws_credential_access_failed_login.test.yml create mode 100644 tests/cloud/aws_credential_access_rds_password_reset.test.yml diff --git a/detections/cloud/aws_credential_access_failed_login.yml b/detections/cloud/aws_credential_access_failed_login.yml new file mode 100644 index 0000000000..fd6fc48bfb --- /dev/null +++ b/detections/cloud/aws_credential_access_failed_login.yml @@ -0,0 +1,62 @@ +name: AWS Credential Access Failed Login +id: a19b354d-0d7f-47f3-8ea6-1a7c36434968 +version: 1 +date: '2022-08-07' +author: Gowthamaraj Rajendran, Splunk +type: TTP +datamodel: +- Endpoint +description: It shows that there have been an unsuccessful attempt to log in using the user identity to the AWS management console. + Since the user identity has access to AWS account services and resources, an attacker might try to brute force the password for that identity. +search: '`cloudtrail` eventName=ConsoleLogin "responseElements.ConsoleLogin"=Failure eventSource="signin.amazonaws.com" | stats + count min(_time) as firstTime max(_time) as lastTime values(userIdentity.userName) as Username values(userIdentity.accountId) as AccountID by sourceIPAddress awsRegion eventName userAgent| `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` | `aws_credential_access_failed_login_filter`' +how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. +known_false_positives: Users may genuinely mistype or forget the password. +references: +- https://attack.mitre.org/techniques/T1110/001/ +tags: + analytic_story: + - AWS Credential Access + asset_type: AWS Account + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Cloud Data + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json + impact: 70 + kill_chain_phases: + - Exploitation + message: User $Username$ has a login failure from IP $sourceIPAddress$ + mitre_attack_id: + - T1110.001 + nist: + - DE.CM + observable: + - name: sourceIPAddress + type: IP Address + role: + - Attacker + - name: Username + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - eventSource + - userIdentity.userName + - userAgent + - userIdentity.accountId + - sourceIPAddress + - awsRegion + risk_score: 49 + security_domain: threat diff --git a/detections/cloud/aws_credential_access_rds_password_reset.yml b/detections/cloud/aws_credential_access_rds_password_reset.yml new file mode 100644 index 0000000000..8f0990b6bd --- /dev/null +++ b/detections/cloud/aws_credential_access_rds_password_reset.yml @@ -0,0 +1,56 @@ +name: AWS Credential Access RDS Password reset +id: 6153c5ea-ed30-4878-81e6-21ecdb198189 +version: 1 +date: '2022-08-07' +author: Gowthamaraj Rajendran, Splunk +type: TTP +datamodel: +- Endpoint +description: The master user password for Amazon RDS DB instance can be reset using the Amazon RDS console. +search: '`cloudtrail` eventSource="rds.amazonaws.com" eventName=ModifyDBInstance "requestParameters.masterUserPassword"=* | stats + count min(_time) as firstTime max(_time) as lastTime values(requestParameters.dBInstanceIdentifier) as DB by sourceIPAddress awsRegion eventName userAgent| `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` | `aws_credential_access_rds_password_reset_filter`' +how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. +known_false_positives: Users may genuinely reset the RDS password. +references: +- https://aws.amazon.com/premiumsupport/knowledge-center/reset-master-user-password-rds/ +tags: + analytic_story: + - AWS Credential Access + asset_type: AWS Account + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Cloud Data + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.002/aws_rds_password_reset/aws_cloudtrail_events.json + impact: 70 + kill_chain_phases: + - Exploitation + message: $DB$ password has been reset from IP $sourceIPAddress$ + mitre_attack_id: + - T1110.002 + nist: + - DE.CM + observable: + - name: sourceIPAddress + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - eventSource + - requestParameters.dBInstanceIdentifier + - userAgent + - sourceIPAddress + - awsRegion + risk_score: 49 + security_domain: threat diff --git a/tests/cloud/aws_credential_access_failed_login.test.yml b/tests/cloud/aws_credential_access_failed_login.test.yml new file mode 100644 index 0000000000..45dfd762e9 --- /dev/null +++ b/tests/cloud/aws_credential_access_failed_login.test.yml @@ -0,0 +1,13 @@ +name: AWS Credential Access Failed Login Unit Test +tests: +- name: AWS Credential Access Failed Login + file: cloud/aws_credential_access_failed_login.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: aws_cloudtrail_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json + source: aws_cloudtrail + sourcetype: aws:cloudtrail + update_timestamp: true diff --git a/tests/cloud/aws_credential_access_rds_password_reset.test.yml b/tests/cloud/aws_credential_access_rds_password_reset.test.yml new file mode 100644 index 0000000000..5761d3c915 --- /dev/null +++ b/tests/cloud/aws_credential_access_rds_password_reset.test.yml @@ -0,0 +1,13 @@ +name: AWS Credential Access RDS Password reset Unit Test +tests: +- name: AWS Credential Access RDS Password reset + file: cloud/aws_credential_access_rds_password_reset.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: aws_cloudtrail_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.002/aws_rds_password_reset/aws_cloudtrail_events.json + source: aws_cloudtrail + sourcetype: aws:cloudtrail + update_timestamp: true From 758f91deea94db92b03a34a5aa48faf9e0299a25 Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Mon, 8 Aug 2022 02:30:59 -0400 Subject: [PATCH 2/8] Edit file for aws rds password detection --- .../cloud/aws_credential_access_rds_password_reset.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/detections/cloud/aws_credential_access_rds_password_reset.yml b/detections/cloud/aws_credential_access_rds_password_reset.yml index 8f0990b6bd..57ee6820ee 100644 --- a/detections/cloud/aws_credential_access_rds_password_reset.yml +++ b/detections/cloud/aws_credential_access_rds_password_reset.yml @@ -6,14 +6,16 @@ author: Gowthamaraj Rajendran, Splunk type: TTP datamodel: - Endpoint -description: The master user password for Amazon RDS DB instance can be reset using the Amazon RDS console. +description: The master user password for Amazon RDS DB instance can be reset using the Amazon RDS console. Using this technique, the attacker can get access to the + sensitive data from the DB. Usually, the production databases may have sensitive data like Credit card information, PII, Health care Data. This event should be + investigated further. search: '`cloudtrail` eventSource="rds.amazonaws.com" eventName=ModifyDBInstance "requestParameters.masterUserPassword"=* | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.dBInstanceIdentifier) as DB by sourceIPAddress awsRegion eventName userAgent| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_credential_access_rds_password_reset_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. known_false_positives: Users may genuinely reset the RDS password. references: -- https://aws.amazon.com/premiumsupport/knowledge-center/reset-master-user-password-rds/ +- https://aws.amazon.com/premiumsupport/knowledge-center/reset-master-user-password-rds tags: analytic_story: - AWS Credential Access From d1c0d94fd2df698c2663f90addd43a21756a1ba7 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 9 Aug 2022 16:02:19 -0700 Subject: [PATCH 3/8] story file --- stories/aws_credential_access.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 stories/aws_credential_access.yml diff --git a/stories/aws_credential_access.yml b/stories/aws_credential_access.yml new file mode 100644 index 0000000000..24ae012a03 --- /dev/null +++ b/stories/aws_credential_access.yml @@ -0,0 +1,18 @@ +name: AWS Credential Access +id: 4210b690-293f-411d-a9d8-bcfb2ea5fff9 +version: 1 +date: '2022-08-19' +author: Gowthamaraj Rajendran, Bhavin Patel, Splunk +description: Identify activity and techniques associated with accessing credential files from AWS resources, monitor unusual authentication related activities to the AWS Console and other services such as RDS. +narrative: Adversaries employ a variety of techniques to steal AWS Cloud credentials like account names, passwords and keys. Usage of legitimate keys will assist the attackers to gain access to other sensitive system and they can also mimic legitimate behaviour making them harder to be detected. Such activity may involve mulitple failed login to the console, new console logins and password reset activities. +references: +- https://attack.mitre.org/tactics/TA0006/ +tags: + analytic_story: AWS Credential Access + category: + - Cloud Security + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Security Monitoring From 8b6df0a60040076d2bd9526b41bd1a81953f0f5f Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 9 Aug 2022 16:25:16 -0700 Subject: [PATCH 4/8] tagged other detections --- detections/cloud/detect_aws_console_login_by_new_user.yml | 1 + .../cloud/detect_aws_console_login_by_user_from_new_city.yml | 1 + .../cloud/detect_aws_console_login_by_user_from_new_country.yml | 1 + .../cloud/detect_aws_console_login_by_user_from_new_region.yml | 1 + 4 files changed, 4 insertions(+) diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index c716c37f3a..268265bc68 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -32,6 +32,7 @@ references: [] tags: analytic_story: - Suspicious Cloud Authentication Activities + - AWS Credential Access asset_type: AWS Instance cis20: - CIS 16 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index d68d521be8..5f778e89d5 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -38,6 +38,7 @@ tags: analytic_story: - Suspicious AWS Login Activities - Suspicious Cloud Authentication Activities + - AWS Credential Access asset_type: AWS Instance cis20: - CIS 16 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index 73c4248d4d..ba41bc20f1 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -38,6 +38,7 @@ tags: analytic_story: - Suspicious AWS Login Activities - Suspicious Cloud Authentication Activities + - AWS Credential Access asset_type: AWS Instance cis20: - CIS 16 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index 0e046801ac..cfe68f8a00 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -38,6 +38,7 @@ tags: analytic_story: - Suspicious AWS Login Activities - Suspicious Cloud Authentication Activities + - AWS Credential Access asset_type: AWS Instance cis20: - CIS 16 From 8d25d3d27ae0139c9587b61828729f5ce857c7a8 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 10 Aug 2022 16:03:18 -0700 Subject: [PATCH 5/8] getpassworddata --- .../aws_credential_access_getpassworddata.yml | 61 +++++++++++++++++++ ...credential_access_getpassworddata.test.yml | 13 ++++ 2 files changed, 74 insertions(+) create mode 100644 detections/cloud/aws_credential_access_getpassworddata.yml create mode 100644 tests/cloud/aws_credential_access_getpassworddata.test.yml diff --git a/detections/cloud/aws_credential_access_getpassworddata.yml b/detections/cloud/aws_credential_access_getpassworddata.yml new file mode 100644 index 0000000000..4f6c9ea457 --- /dev/null +++ b/detections/cloud/aws_credential_access_getpassworddata.yml @@ -0,0 +1,61 @@ +name: AWS Credential Access GetPasswordData +id: 4d347c4a-306e-41db-8d10-b46baf71b3e2 +version: 1 +date: '2022-08-10' +author: Bhavin Patel, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This detection analytic identifies more than 10 GetPasswordData API calls made to your AWS account with a time window of 5 minutes. Attackers can retrieve the encrypted administrator password for a running Windows instance. +search: '| `cloudtrail` eventName=GetPasswordData eventSource = ec2.amazonaws.com | bin _time span=5m | stats count values(errorCode) as errorCode dc(requestParameters.instanceId) as distinct_instance_ids values(requestParameters.instanceId) as instance_ids by aws_account_id src_ip user_arn userAgent eventName _time +| where distinct_instance_ids > 10 | `aws_credential_access_getpassworddata_filter`' +how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. We encourage the users to adjust the values of `distinct_instance_ids` and tweak the `span` value according to their environment. +known_false_positives: Administrator tooling or automated scripts may make these calls but it is highly unlikely to make several calls in a short period of time. +references: +- https://attack.mitre.org/techniques/T1552/ +- https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.ec2-get-password-data/ +tags: + analytic_story: + - AWS Credential Access + asset_type: AWS Account + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Cloud Data + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/aws_getpassworddata/aws_cloudtrail_events.json + impact: 70 + kill_chain_phases: + - Exploitation + message: User $user_arn$ is seen to make mulitple `GetPasswordData` API calls to instance ids $instance_ids$ from IP $src_ip$ + mitre_attack_id: + - T1552 + nist: + - DE.CM + observable: + - name: src_ip + type: IP Address + role: + - Attacker + - name: Username + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - eventSource + - userIdentity.userName + - userAgent + - userIdentity.accountId + - sourceIPAddress + - awsRegion + risk_score: 49 + security_domain: threat \ No newline at end of file diff --git a/tests/cloud/aws_credential_access_getpassworddata.test.yml b/tests/cloud/aws_credential_access_getpassworddata.test.yml new file mode 100644 index 0000000000..72eb51b315 --- /dev/null +++ b/tests/cloud/aws_credential_access_getpassworddata.test.yml @@ -0,0 +1,13 @@ +name: AWS Credential Access GetPasswordData Unit Test +tests: +- name: AWS Credential Access GetPasswordData + file: cloud/aws_credential_access_getpassworddata.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: aws_cloudtrail_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/aws_getpassworddata/aws_cloudtrail_events.json + source: aws_cloudtrail + sourcetype: aws:cloudtrail + update_timestamp: true From 1952b9773bd476f6b0f9eed9133f6042897f1a1b Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 11 Aug 2022 12:10:47 -0700 Subject: [PATCH 6/8] Update aws_credential_access_getpassworddata.yml --- detections/cloud/aws_credential_access_getpassworddata.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/aws_credential_access_getpassworddata.yml b/detections/cloud/aws_credential_access_getpassworddata.yml index 4f6c9ea457..f9b35c4601 100644 --- a/detections/cloud/aws_credential_access_getpassworddata.yml +++ b/detections/cloud/aws_credential_access_getpassworddata.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: - Endpoint description: This detection analytic identifies more than 10 GetPasswordData API calls made to your AWS account with a time window of 5 minutes. Attackers can retrieve the encrypted administrator password for a running Windows instance. -search: '| `cloudtrail` eventName=GetPasswordData eventSource = ec2.amazonaws.com | bin _time span=5m | stats count values(errorCode) as errorCode dc(requestParameters.instanceId) as distinct_instance_ids values(requestParameters.instanceId) as instance_ids by aws_account_id src_ip user_arn userAgent eventName _time +search: '`cloudtrail` eventName=GetPasswordData eventSource = ec2.amazonaws.com | bin _time span=5m | stats count values(errorCode) as errorCode dc(requestParameters.instanceId) as distinct_instance_ids values(requestParameters.instanceId) as instance_ids by aws_account_id src_ip user_arn userAgent eventName _time | where distinct_instance_ids > 10 | `aws_credential_access_getpassworddata_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. We encourage the users to adjust the values of `distinct_instance_ids` and tweak the `span` value according to their environment. known_false_positives: Administrator tooling or automated scripts may make these calls but it is highly unlikely to make several calls in a short period of time. @@ -58,4 +58,4 @@ tags: - sourceIPAddress - awsRegion risk_score: 49 - security_domain: threat \ No newline at end of file + security_domain: threat From 24cd1afcb82c062ce31ecb37037ad24a71443eaf Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 12 Aug 2022 12:34:02 -0700 Subject: [PATCH 7/8] updatesusing datamodel --- .../aws_credential_access_failed_login.yml | 24 +++++++++---------- .../aws_credential_access_getpassworddata.yml | 5 ++-- ...s_credential_access_rds_password_reset.yml | 3 +-- 3 files changed, 14 insertions(+), 18 deletions(-) diff --git a/detections/cloud/aws_credential_access_failed_login.yml b/detections/cloud/aws_credential_access_failed_login.yml index fd6fc48bfb..5d6a469020 100644 --- a/detections/cloud/aws_credential_access_failed_login.yml +++ b/detections/cloud/aws_credential_access_failed_login.yml @@ -5,12 +5,10 @@ date: '2022-08-07' author: Gowthamaraj Rajendran, Splunk type: TTP datamodel: -- Endpoint +- Authentication description: It shows that there have been an unsuccessful attempt to log in using the user identity to the AWS management console. Since the user identity has access to AWS account services and resources, an attacker might try to brute force the password for that identity. -search: '`cloudtrail` eventName=ConsoleLogin "responseElements.ConsoleLogin"=Failure eventSource="signin.amazonaws.com" | stats - count min(_time) as firstTime max(_time) as lastTime values(userIdentity.userName) as Username values(userIdentity.accountId) as AccountID by sourceIPAddress awsRegion eventName userAgent| `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `aws_credential_access_failed_login_filter`' +search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Authentication where Authentication.action = failure BY Authentication.app Authentication.signature Authentication.dest Authentication.user Authentication.action Authentication.user_id Authentication.src | `drop_dm_object_name(Authentication)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_credential_access_failed_login_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. known_false_positives: Users may genuinely mistype or forget the password. references: @@ -31,17 +29,17 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: User $Username$ has a login failure from IP $sourceIPAddress$ + message: User $user$ has a login failure from IP $src$ mitre_attack_id: - T1110.001 nist: - DE.CM observable: - - name: sourceIPAddress + - name: src type: IP Address role: - Attacker - - name: Username + - name: user type: User role: - Victim @@ -51,12 +49,12 @@ tags: - Splunk Cloud required_fields: - _time - - eventName + - app - eventSource - - userIdentity.userName - - userAgent - - userIdentity.accountId - - sourceIPAddress - - awsRegion + - action + - signature + - dest + - user + - user_id risk_score: 49 security_domain: threat diff --git a/detections/cloud/aws_credential_access_getpassworddata.yml b/detections/cloud/aws_credential_access_getpassworddata.yml index 4f6c9ea457..10f7109acd 100644 --- a/detections/cloud/aws_credential_access_getpassworddata.yml +++ b/detections/cloud/aws_credential_access_getpassworddata.yml @@ -4,8 +4,7 @@ version: 1 date: '2022-08-10' author: Bhavin Patel, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This detection analytic identifies more than 10 GetPasswordData API calls made to your AWS account with a time window of 5 minutes. Attackers can retrieve the encrypted administrator password for a running Windows instance. search: '| `cloudtrail` eventName=GetPasswordData eventSource = ec2.amazonaws.com | bin _time span=5m | stats count values(errorCode) as errorCode dc(requestParameters.instanceId) as distinct_instance_ids values(requestParameters.instanceId) as instance_ids by aws_account_id src_ip user_arn userAgent eventName _time | where distinct_instance_ids > 10 | `aws_credential_access_getpassworddata_filter`' @@ -40,7 +39,7 @@ tags: type: IP Address role: - Attacker - - name: Username + - name: user_arn type: User role: - Victim diff --git a/detections/cloud/aws_credential_access_rds_password_reset.yml b/detections/cloud/aws_credential_access_rds_password_reset.yml index 57ee6820ee..7346657dec 100644 --- a/detections/cloud/aws_credential_access_rds_password_reset.yml +++ b/detections/cloud/aws_credential_access_rds_password_reset.yml @@ -4,8 +4,7 @@ version: 1 date: '2022-08-07' author: Gowthamaraj Rajendran, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: The master user password for Amazon RDS DB instance can be reset using the Amazon RDS console. Using this technique, the attacker can get access to the sensitive data from the DB. Usually, the production databases may have sensitive data like Credit card information, PII, Health care Data. This event should be investigated further. From 1e4b0353f84632688d637eafa466ea9a24e27a54 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 12 Aug 2022 12:46:25 -0700 Subject: [PATCH 8/8] search update --- detections/cloud/aws_credential_access_failed_login.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/aws_credential_access_failed_login.yml b/detections/cloud/aws_credential_access_failed_login.yml index 5d6a469020..dea0c9dfa6 100644 --- a/detections/cloud/aws_credential_access_failed_login.yml +++ b/detections/cloud/aws_credential_access_failed_login.yml @@ -2,13 +2,13 @@ name: AWS Credential Access Failed Login id: a19b354d-0d7f-47f3-8ea6-1a7c36434968 version: 1 date: '2022-08-07' -author: Gowthamaraj Rajendran, Splunk +author: Gowthamaraj Rajendran, Bhavin Patel, Splunk type: TTP datamodel: - Authentication description: It shows that there have been an unsuccessful attempt to log in using the user identity to the AWS management console. Since the user identity has access to AWS account services and resources, an attacker might try to brute force the password for that identity. -search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Authentication where Authentication.action = failure BY Authentication.app Authentication.signature Authentication.dest Authentication.user Authentication.action Authentication.user_id Authentication.src | `drop_dm_object_name(Authentication)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_credential_access_failed_login_filter`' +search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Authentication where Authentication.action = failure Authentication.app=AwsConsoleSignIn Authentication.signature=ConsoleLogin BY Authentication.app Authentication.signature Authentication.dest Authentication.user Authentication.action Authentication.user_id Authentication.src | `drop_dm_object_name(Authentication)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_credential_access_failed_login_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. known_false_positives: Users may genuinely mistype or forget the password. references: